@ngockhoale/ukit 3.4.65 → 3.4.67

package/template_project/.claude/skills/advisor-plan/SKILL.md

@@ -28,6 +28,7 @@ This skill is **planning-only**. A create session that loads it edits docs and t
 ### Phase A — Gather (lite tier)
 
 1. Read the document header and table of contents; unreadable or empty source → write ledger row `R-000 | blocker` naming the missing input, create no tasks, stop.
+1a. **Source snapshot** — before chunking, write `${OUTPUT_ROOT}SOURCE.md` with the original path (or the durable verbatim message origin for chat input), the `sha256` of the original bytes, and a verbatim copy of the full source text (see [REFERENCE.md](./REFERENCE.md#source-snapshot)). Chunks and citations point into this copy, never into a paraphrase.
 2. Split into chunks of at most 800 lines; one bounded gatherer per chunk extracts candidate requirements as `Source` (section/line) + normalized text. Dedupe by normalized text, keep the first source; contradictory requirements become a `blocker` row.
 3. **Feasibility evidence** — per requirement, inspect the CURRENT source index-first (`query-index.mjs` / `resolve-context.mjs`, then read the code that would change) plus `git log`, `git diff` and `git status` of the touched areas. Record each finding in the ledger row as evidence (file:line or commit) using the block in [REFERENCE.md](./REFERENCE.md#feasibility-evidence). Gatherers collect; the smart tier decides.
 4. **Related-project research (default on, bounded)** — per requirement cluster search the internet / GitHub for related projects and prior art (how others solved it, what to adopt or avoid) via `.claude/skills/research/SKILL.md`, under the sanitized-query and untrusted-source rules in [REFERENCE.md](./REFERENCE.md#research-rules). Feed the findings into each row's feasibility evidence. Skip only when no sanitized query is possible or no research tool exists, and record the skip reason in the ledger notes.
@@ -36,13 +37,14 @@ Tier (lite gatherers): on Claude Code start a read-only `general-purpose` subage
 
 ### Phase B — Decide, ledger, plan (smart tier)
 
-1. Use the evidence to assign every extracted requirement exactly one disposition: `feasible`, `adapted`, `deferred`, or `blocker`. `adapted` lists 2-3 alternatives with the chosen one marked; `deferred` names its queue entry; `blocker` names the missing precondition.
-2. Every `feasible`/`adapted` row names a task and a test or acceptance check.
+1. Use the evidence to assign every extracted requirement exactly one disposition: `feasible`, `adapted`, `deferred`, or `blocker`. `adapted` lists 2-3 alternatives with the chosen one marked; `deferred` names its queue entry and a justification; `blocker` names the missing prerequisite or owner conflict.
+2. Only `feasible`/`adapted` rows map to executable tasks, and each maps to an executable acceptance criterion and a test or verification command. `deferred` rows need a justification and a queue entry, not a task. `blocker` rows need the missing prerequisite or owner decision named, not a task. Rows the source marks as proposal, example, or rejected are not promoted to tasks: they stay as classified NOTES entries with their rationale.
 3. Write `${OUTPUT_ROOT}LEDGER.md` with the footer `Coverage: N/N rows dispositioned` and the sentence "disposition coverage is not implementation coverage". Never claim "100% implemented".
 4. **Candidate plans** — draft 2-3 candidate whole-plans (different decomposition, risk, ordering), score them on the rubric in [REFERENCE.md](./REFERENCE.md#candidate-plan-rubric), pick the best, and record the choice plus rejected alternatives in `PLAN.md`.
 5. Write SPEC, PLAN and the `TASK-*.md` files through the existing `/ukit:handoff-create` planner. Every task carries detailed TDD test cases that PROVE it works (happy, edge and error cases with the expected result), never just "tests pass".
-6. Queue rule: at most 10 tasks in total (short plan): all active for the next implement cycle; more than 10: the first 10 by dependency order are active and the rest become queued blueprints under `docs/AI_HANDOFF/queued/<slug>/` with the queue header from [REFERENCE.md](./REFERENCE.md#queue-header), drained gradually by later cycles.
-7. Replan: append ledger deltas and supersede with `-R<n>` rules; never overwrite a task that carries an executor report.
+6. Queue rule: at most 10 tasks in total (short plan): all active for the next implement cycle; more than 10: the first 10 by dependency order are active and the rest become queued blueprints under `docs/AI_HANDOFF/queued/<slug>/`. Mandatory overflow (`feasible`/`adapted` rows) is queued WITHOUT `QueueIntent` (no `Queue*` header line), so fullstack folds it in as a legacy blueprint. Only `deferred` rows get the deliberate-future header from [REFERENCE.md](./REFERENCE.md#queue-header) (`QueueIntent: deliberate-future`), which fullstack reports as backlog and never folds.
+7. Replan: append ledger deltas and supersede with `-R<n>` rules; never overwrite a task that carries an executor report. A replan that overwrites a prior PLAN.md first copies the prior files to `amendments/rev-<NN>/` and records the prior requirement, decision and task versions, what changed, and the `invalidated` evidence under `## Amendment History` in PLAN.md.
+8. **Semantic record (mandatory; Source-only notes live in NOTES.md)** — every classification, exclusion, and its rationale must be recorded somewhere durable. The mandatory record is the LEDGER (dispositions and rationale) plus the rationale for every non-task item (proposal, example, rejected, superseded, assumption, question). The file name `${OUTPUT_ROOT}NOTES.md` (see [REFERENCE.md](./REFERENCE.md#source-only-notes)) is the default place for those non-task items; an equivalent record under another name is acceptable, but the content is not optional.
 
 Tier (smart decide): Claude Code uses the `opus`/`unic-smart` agent (`handoff-planner`); omp uses `@slow` (or `@default` when no slow role is configured).
 

package/template_project/.claude/ukit/index/route-resolver.mjs

@@ -1158,12 +1158,12 @@ function declaredReadOnly(promptText, releasePolicy) {
 // "template/install", "source change") as mutation orders. Order is structural: a request whose
 // command-position verbs are verification verbs, with no explicit order (hasExplicitOrder) and no
 // change-leading clause, orders no change - it owes verification evidence, not a write.
-const VERIFY_LEAD = /^(?:[-*+•>\d.)\s]*)(?:(?:please|hay|vui long|now|also|first|then)\s+)*(?:verify|re-?run|confirm|xac nhan|validate|double-?check)\b/;
+const VERIFY_LEAD = /^(?:[-*+•>\d.)\s]*)(?:(?:please|hay|vui long|now|also|first|then)\s+)*(?:(?:keep|continue|tiep tuc)\s+)?(?:verify|re-?run|confirm|xac nhan|validate|double-?check|wait(?:ing)?|monitor|watch|cho(?=\s+(?:dung\s+)?(?:job|verifier|build|test|suite|gate|ci|run|task|ket qua|xong|output)\b))\b/;
 const CHANGE_LEAD = /^(?:[-*+•>\d.)\s]*)(?:(?:please|hay|vui long|now|also|first|then)\s+)*(?:make|rebuild|redo|rewrite|restore|revert|correct|clean|patch|resolve|ensure|run(?!(?=[^.]*\b(?:tests?|suite|gate|checks?|lint|typecheck|pilot|smoke|e2e|verif\w*|vitest|jest|audit)\b)))\b/;
 export function isVerificationOnlyRequest(promptText) {
   const plain = String(promptText ?? '').normalize('NFD').replace(/[̀-ͯ]/g, '').replace(/[đĐ]/g, 'd').toLowerCase()
     .replace(/```[\s\S]*?```/g, ' ').replace(/^[ \t]*>.*$/gm, ' ');
-  const clauses = neutralizeNonOrders(plain).split(/\s*(?:[;\n,]|\.(?:\s+|$)|\band\b|\bthen\b|\bva\b)\s*/)
+  const clauses = neutralizeNonOrders(plain).split(/\s*(?:[;\n,]|\.(?:\s+|$)|\band\b|\bthen\b|\bva\b|\broi\b)\s*/)
     .map((clause) => clause.split(/\bwithout\b/)[0]);
   return clauses.some((clause) => VERIFY_LEAD.test(clause)) && !hasExplicitOrder(clauses)
     && !clauses.some((clause) => CHANGE_LEAD.test(clause));

package/template_project/.claude/ukit/runtime/resumable-run.mjs

@@ -1014,7 +1014,7 @@ export async function countActiveTaskClaims(projectRoot, { now = Date.now() } =
 // --- Archive-time status snapshot ---------------------------------------------------
 // INDEX.md owns the task lifecycle; a task file's own `- Status:` header is executor-written
 // and goes stale (`ready`) once the task is archived. `archiveCycleSnapshot` persists the
-// verified terminal INDEX rows beside the archived task files (`archive/cycle-NN/INDEX.md`),
+// current INDEX rows beside the archived task files (`ARCHIVE/cycle-NN/INDEX.md`),
 // which is what the Stop predicate (stop-coordinator `evalFinalizedCycles`) reads. Idempotent,
 // crash-safe (run it BEFORE the INDEX reset; a retry after a partial archive just re-derives),
 // and fail-closed: a non-terminal live row is recorded as-is, never promoted.
@@ -1033,20 +1033,49 @@ function indexRows(text) {
 }
 
 /**
- * Snapshot the live INDEX rows of the tasks that belong to `archive/cycle-<NN>/` (task files
- * already moved there, or still in `tasks/` and about to move) and stamp each archived task
+ * Snapshot the live INDEX rows of tasks already moved into `ARCHIVE/cycle-<NN>/`
+ * (or an existing legacy lowercase cycle) and stamp each archived task
  * header with its terminal INDEX status. Returns `{ ok, cycle, snapshotted, stamped, unchanged }`.
  */
 export async function archiveCycleSnapshot(projectRoot, cycle) {
   const nn = String(cycle).padStart(2, '0');
   if (!/^\d{2,}$/.test(nn)) return { ok: false, reason: 'bad-cycle' };
   const ai = path.join(projectRoot, 'docs', 'AI_HANDOFF');
-  const dir = path.join(ai, 'archive', `cycle-${nn}`);
+  let dir = path.join(ai, 'ARCHIVE', `cycle-${nn}`);
+  // Recovery of an already-moved legacy cycle must not lose its task records on
+  // case-sensitive hosts. New cycles are created by F3 under ARCHIVE only.
+  try {
+    await fs.access(dir);
+  } catch (error) {
+    if (error?.code !== 'ENOENT') return { ok: false, reason: 'archive-unreadable' };
+    const legacy = path.join(ai, 'archive', `cycle-${nn}`);
+    try { await fs.access(legacy); dir = legacy; } catch (legacyError) {
+      if (legacyError?.code !== 'ENOENT') return { ok: false, reason: 'legacy-archive-unreadable' };
+    }
+  }
+  // Archive writes must never follow a project record symlink into another workspace.
+  for (const target of [path.join(projectRoot, 'docs'), ai, path.dirname(dir), dir, path.join(dir, 'INDEX.md')]) {
+    try {
+      if ((await fs.lstat(target)).isSymbolicLink()) return { ok: false, reason: 'archive-symlink' };
+    } catch (error) {
+      if (error?.code !== 'ENOENT') return { ok: false, reason: 'archive-unreadable' };
+    }
+  }
   const snapPath = path.join(dir, 'INDEX.md');
   let live = new Map();
   try { live = indexRows(await fs.readFile(path.join(ai, 'INDEX.md'), 'utf8')); } catch { /* header-only / missing → rely on prior snapshot */ }
   let prior = new Map();
-  try { prior = indexRows(await fs.readFile(snapPath, 'utf8')); } catch { /* first run */ }
+  try {
+    const priorText = await fs.readFile(snapPath, 'utf8');
+    const taskRows = priorText.split('\n').map((line) => line.trim()).filter((line) => /^\|\s*TASK-/i.test(line));
+    if (taskRows.length === 0 || taskRows.some((row) => !row.endsWith('|') || row.split('|').slice(1, -1).length !== 8)) {
+      return { ok: false, reason: 'prior-snapshot-malformed' };
+    }
+    prior = indexRows(priorText);
+    if (prior.size !== taskRows.length) return { ok: false, reason: 'prior-snapshot-malformed' };
+  } catch (error) {
+    if (error?.code !== 'ENOENT') return { ok: false, reason: 'prior-snapshot-unreadable' };
+  }
   // Only task files already inside THIS cycle's archive folder are snapshotted (F3 moves them
   // first). Task ids restart per cycle, so the live `tasks/` and live INDEX rows of a LATER
   // cycle must never be attributed here: an existing snapshot row is immutable (prior wins);
@@ -1054,9 +1083,13 @@ export async function archiveCycleSnapshot(projectRoot, cycle) {
   const ids = new Set();
   try {
     for (const f of await fs.readdir(dir)) {
-      if (/^TASK-[\w.-]+\.md$/i.test(f)) ids.add(f.replace(/\.md$/i, '').toUpperCase());
+      if (!/^TASK-[\w.-]+\.md$/i.test(f)) continue;
+      if ((await fs.lstat(path.join(dir, f))).isSymbolicLink()) return { ok: false, reason: 'archive-symlink' };
+      ids.add(f.replace(/\.md$/i, '').toUpperCase());
     }
-  } catch { /* absent dir */ }
+  } catch (error) {
+    return { ok: false, reason: error?.code === 'ENOENT' ? 'no-task-files' : 'archive-unreadable' };
+  }
   if (ids.size === 0) return { ok: false, reason: 'no-task-files' };
   const merged = new Map();
   for (const id of [...ids].sort()) {

package/template_project/.claude/ukit/runtime/stop-coordinator.mjs

@@ -797,9 +797,31 @@ function parseRunCursor(text) {
     next: field('Next'),
     exitPredicate: field('ExitPredicate'),
     goalScope: field('GoalScope').toLowerCase(),
+    scopeQueue: field('ScopeQueue'),
+    cycle: field('Cycle'),
   };
 }
 
+// Additive optional RUN field `Cycle:` (e.g. `cycle-02` or `02`) pins the archived cycle this
+// run owns. Blank → null (legacy: every archived cycle counts). Normalised to `cycle-NN`.
+function parseRunCycle(value) {
+  const raw = String(value ?? '').trim();
+  if (!raw) return null;
+  const m = raw.match(/^(?:cycle-)?(\d+)$/i);
+  return m ? `cycle-${m[1].padStart(2, '0')}` : `invalid:${raw}`;
+}
+
+// Frozen queue membership (optional RUN field `ScopeQueue:`). Comma-separated blueprint slugs
+// the run agreed to consume. Absent/blank → null (legacy: every queued blueprint counts).
+// `none` → empty set (nothing in scope). A blueprint queued later is NOT in the set and so
+// never extends this run's scope.
+export function parseScopeQueue(value) {
+  const raw = String(value ?? '').trim();
+  if (!raw) return null;
+  if (/^none$/i.test(raw)) return new Set();
+  return new Set(raw.split(',').map((s) => s.trim()).filter(Boolean));
+}
+
 // ─── Goal backlog beyond the active cycle ──────────────────────────────────
 // A finalized cycle resets INDEX.md to a header-only table, so "empty INDEX" proves nothing
 // about the GOAL. For a run-all goal (`GoalScope: run-all` in RUN.md) the authoritative
@@ -807,7 +829,9 @@ function parseRunCursor(text) {
 // docs/AI_HANDOFF/queued/<slug>/ — excluding `QueueIntent: deliberate-future` ones (separate
 // backlog by contract) and blueprints already moved to archive/. Unreadable → null (unknown is
 // never "nothing left").
-export async function pendingQueuedBlueprints(runRoot) {
+// `scope` (optional Set from parseScopeQueue): when given, only the frozen slugs count, so a
+// blueprint queued after the run froze its scope never extends that run. null = legacy, all count.
+export async function pendingQueuedBlueprints(runRoot, scope = null) {
   const dir = path.join(runRoot, 'docs', 'AI_HANDOFF', 'queued');
   let entries;
   try {
@@ -818,6 +842,7 @@ export async function pendingQueuedBlueprints(runRoot) {
   const pending = [];
   for (const entry of entries) {
     if (!entry.isDirectory()) continue;
+    if (scope && !scope.has(entry.name)) continue;
     let header = '';
     try {
       header = await fs.readFile(path.join(dir, entry.name, 'HANDOFF.md'), 'utf8');
@@ -860,21 +885,23 @@ export function parseExitPredicate(expr) {
  * terminal-success status (`done` or `cancelled_superseded`). An unreadable or
  * taskless INDEX cannot prove all-done, so the term fails.
  */
-async function evalIndexAllDone(projectRoot, { goalScope = '' } = {}) {
+async function evalIndexAllDone(projectRoot, { goalScope = '', scopeQueue = '', cycleField = '' } = {}) {
   let text;
   try {
     text = await fs.readFile(path.join(projectRoot, 'docs', 'AI_HANDOFF', 'INDEX.md'), 'utf8');
   } catch {
     return { pass: false, detail: 'INDEX.md unreadable' };
   }
-  const rows = String(text)
-    .split('\n')
-    .map((line) => line.trim())
-    .filter((line) => /^\|\s*TASK-/i.test(line));
-  if (rows.length === 0) return evalFinalizedCycles(projectRoot, goalScope);
+  const rows = indexTaskRows(text);
+  if (rows.length === 0) return evalFinalizedCycles(projectRoot, goalScope, scopeQueue, cycleField);
   const failing = [];
   for (const row of rows) {
-    const cells = row.split('|').map((c) => c.trim()).filter(Boolean);
+    if (!indexTaskRowIsWellFormed(row)) {
+      const shape = row.startsWith('|') ? 'malformed task row' : 'unsupported task row (missing outer leading pipe)';
+      failing.push(`${shape} (expected ${INDEX_TASK_COLUMNS} columns): ${row.slice(0, 60)}`);
+      continue;
+    }
+    const cells = indexTaskCells(row);
     const status = (cells[4] || '').toLowerCase();
     if (status !== 'done' && status !== 'cancelled_superseded') {
       failing.push(`${cells[0]}=${cells[4] || '?'}`);
@@ -886,12 +913,16 @@ async function evalIndexAllDone(projectRoot, { goalScope = '' } = {}) {
 }
 
 /** Task id → lower-cased status from the rows of an INDEX.md (or archive INDEX snapshot). */
+// Returns Map<id, status>, or null when any TASK row is not the 8-column writer shape: a
+// malformed snapshot proves nothing and must fail closed rather than shift Status onto
+// another column.
 function parseIndexStatuses(text) {
   const map = new Map();
   for (const line of String(text).split('\n')) {
     const row = line.trim();
     if (!/^\|\s*TASK-/i.test(row)) continue;
-    const cells = row.split('|').slice(1, -1).map((c) => c.trim()); // keep empty cells: columns must not shift
+    if (!indexTaskRowIsWellFormed(row)) return null;
+    const cells = indexTaskCells(row);
     map.set(String(cells[0]).toUpperCase(), String(cells[4] || '').toLowerCase());
   }
   return map;
@@ -904,26 +935,62 @@ function parseIndexStatuses(text) {
  * least one archived task exists, every archived task is terminal-success, and — for a run-all
  * goal — no consumable queued blueprint remains. No archive evidence → still unprovable (fail).
  */
-async function evalFinalizedCycles(projectRoot, goalScope) {
-  const base = path.join(projectRoot, 'docs', 'AI_HANDOFF', 'archive');
-  let cycles;
-  try {
-    cycles = (await fs.readdir(base, { withFileTypes: true })).filter((e) => e.isDirectory() && /^cycle-\d+$/.test(e.name));
-  } catch {
-    return { pass: false, detail: 'INDEX.md has no task rows' };
+async function evalFinalizedCycles(projectRoot, goalScope, scopeQueue = '', cycleField = '') {
+  const cycles = [];
+  const seen = new Set();
+  const assignedCycle = parseRunCycle(cycleField);
+  if (assignedCycle && assignedCycle.startsWith('invalid:')) {
+    return { pass: false, detail: `RUN Cycle field is not a cycle id: ${assignedCycle.slice(8)}` };
+  }
+  // Read legacy history without migrating it. Case-insensitive hosts alias both roots;
+  // realpath de-duplicates those aliases while Linux retains distinct histories.
+  for (const spelling of ['ARCHIVE', 'archive']) {
+    const base = path.join(projectRoot, 'docs', 'AI_HANDOFF', spelling);
+    try {
+      const real = await fs.realpath(base);
+      if (seen.has(real)) continue;
+      seen.add(real);
+      for (const entry of await fs.readdir(base, { withFileTypes: true })) {
+        if (entry.isDirectory() && /^cycle-\d+$/.test(entry.name)) {
+          // Explicit Cycle pins the run to its own archive; other histories are unrelated.
+          if (assignedCycle && entry.name.toLowerCase() !== assignedCycle) continue;
+          cycles.push({ name: entry.name, dir: path.join(base, entry.name) });
+        }
+      }
+    } catch (error) {
+      if (error?.code !== 'ENOENT') return { pass: false, detail: 'archive history unreadable' };
+    }
+  }
+  if (cycles.length === 0) {
+    return assignedCycle
+      ? { pass: false, detail: `assigned archive ${assignedCycle} not found` }
+      : { pass: false, detail: 'INDEX.md has no task rows' };
   }
   let total = 0;
   const failing = [];
   for (const cycle of cycles) {
     let files;
-    try { files = await fs.readdir(path.join(base, cycle.name)); } catch { continue; }
+    // A cycle was ENUMERATED above, so it is evidence we owe its obligations. Any readdir failure
+    // here — including ENOENT (the directory vanished after listing) — cannot prove them and must
+    // fail closed; silently skipping it would let an unrelated done cycle release this one.
+    try { files = await fs.readdir(path.join(cycle.dir)); } catch {
+      return { pass: false, detail: `archive cycle unreadable: ${cycle.name}` };
+    }
     // Authoritative status = the INDEX snapshot taken at archive time (resumable-run.mjs
     // archive-cycle). A task file's own `- Status:` header is executor-written and goes stale
     // (`ready`) once INDEX.md owns the lifecycle; it is only the fallback for legacy archives
     // that carry no snapshot. A snapshot row that is NOT terminal always wins (fail closed).
     let snapshot = null;
     if (files.includes('INDEX.md')) {
-      try { snapshot = parseIndexStatuses(await fs.readFile(path.join(base, cycle.name, 'INDEX.md'), 'utf8')); } catch { /* unreadable → header fallback */ }
+      // The snapshot was listed, so it exists as evidence. Any read failure — including ENOENT
+      // (vanished after listing) — or a malformed snapshot fails closed; only a snapshot that was
+      // never listed (the no-INDEX.md branch below) is the legacy header fallback.
+      let raw;
+      try { raw = await fs.readFile(path.join(cycle.dir, 'INDEX.md'), 'utf8'); } catch {
+        return { pass: false, detail: `archive INDEX snapshot unreadable: ${cycle.name}` };
+      }
+      snapshot = parseIndexStatuses(raw);
+      if (snapshot === null) return { pass: false, detail: `archive INDEX snapshot malformed: ${cycle.name}` };
     }
     for (const file of files.filter((f) => /^TASK-[\w.-]+\.md$/i.test(f))) {
       total += 1;
@@ -933,7 +1000,7 @@ async function evalFinalizedCycles(projectRoot, goalScope) {
       let status = snapshot ? (snapshot.get(id) || '') : '';
       if (!snapshot) {
         let body = '';
-        try { body = await fs.readFile(path.join(base, cycle.name, file), 'utf8'); } catch { /* unreadable → not proven */ }
+        try { body = await fs.readFile(path.join(cycle.dir, file), 'utf8'); } catch { /* unreadable → not proven */ }
         status = (body.match(/^-\s*Status:\s*`?([\w-]+)`?/im)?.[1] || '').toLowerCase();
       }
       if (status !== 'done' && status !== 'cancelled_superseded') {
@@ -944,7 +1011,7 @@ async function evalFinalizedCycles(projectRoot, goalScope) {
   if (total === 0) return { pass: false, detail: 'INDEX.md has no task rows' };
   if (failing.length > 0) return { pass: false, detail: `archived task not done: ${failing.join(', ')}` };
   if (String(goalScope).toLowerCase() === 'run-all') {
-    const remaining = await pendingQueuedBlueprints(projectRoot);
+    const remaining = await pendingQueuedBlueprints(projectRoot, parseScopeQueue(scopeQueue));
     if (!Array.isArray(remaining)) return { pass: false, detail: 'queued backlog unreadable' };
     if (remaining.length > 0) return { pass: false, detail: `queued blueprint(s) remain: ${remaining.join(', ')}` };
   }
@@ -1084,7 +1151,7 @@ async function evalVerifyPass(projectRoot) {
  * malformed (unsatisfiable). Advisory like the rest of the lane — a thrown
  * error becomes a failed term, never an exception.
  */
-async function evaluateExitPredicate(projectRoot, expr, { goalScope = '' } = {}) {
+async function evaluateExitPredicate(projectRoot, expr, { goalScope = '', scopeQueue = '', cycleField = '' } = {}) {
   const terms = parseExitPredicate(expr);
   if (!terms) {
     return { ok: false, terms: [{ term: String(expr || '').trim() || '(empty)', pass: false, detail: 'malformed predicate' }] };
@@ -1093,7 +1160,7 @@ async function evaluateExitPredicate(projectRoot, expr, { goalScope = '' } = {})
   for (const term of terms) {
     let r;
     try {
-      if (term === 'index:all-done') r = await evalIndexAllDone(projectRoot, { goalScope });
+      if (term === 'index:all-done') r = await evalIndexAllDone(projectRoot, { goalScope, scopeQueue, cycleField });
       else if (term === 'git:clean') r = evalGitClean(projectRoot);
       else if (term === 'agents:none-running') r = await evalAgentsNoneRunning(projectRoot);
       else if (term === 'verify:pass') r = await evalVerifyPass(projectRoot);
@@ -1235,19 +1302,31 @@ export function deriveGoalStatus({ runCursor = null, tasks = null, ledger = null
 // reconciled in, so the stall signature tracks goal progress, not just cursor
 // wording.
 
+// A task row is any line that starts with a TASK id, with or without the outer leading pipe.
+// The outer-less form is not a supported writer shape: it is still returned here so the
+// well-formedness check below rejects it clearly, instead of silently dropping the task.
 function indexTaskRows(text) {
   return String(text)
     .split('\n')
     .map((line) => line.trim())
-    .filter((line) => /^\|\s*TASK-/i.test(line));
+    .filter((line) => /^\|?\s*TASK-/i.test(line));
 }
 
 function indexTaskCells(row) {
-  return row.split('|').map((c) => c.trim()).filter(Boolean);
+  return row.split('|').slice(1, -1).map((c) => c.trim());
+}
+
+// The writer (INDEX.md header + resumable-run indexRows) emits exactly 8 positional columns.
+// Any other width means a dropped or extra delimiter, so every positional read after it
+// (Status especially) would be shifted onto the wrong column: such a row is malformed.
+const INDEX_TASK_COLUMNS = 8;
+function indexTaskRowIsWellFormed(row) {
+  return indexTaskCells(row).length === INDEX_TASK_COLUMNS;
 }
 
 function indexTasks(indexText) {
   return indexTaskRows(indexText).map((row) => {
+    if (!indexTaskRowIsWellFormed(row)) return { id: '', status: 'malformed' };
     const cells = indexTaskCells(row);
     return { id: cells[0] || '', status: (cells[4] || '').toLowerCase() };
   });
@@ -1414,7 +1493,7 @@ export async function evaluateHandoffCursor({ projectRoot, runRoot = projectRoot
   } catch {
     return { kind: 'none' };
   }
-  const { command, goal, phase, cursor, next, exitPredicate, goalScope } = parseRunCursor(text);
+  const { command, goal, phase, cursor, next, exitPredicate, goalScope, scopeQueue, cycle: cycleField } = parseRunCursor(text);
   // Shared terminal predicate — tests/handoff/cycle21 greps this exact shape across
   // all four RUN.md consumers; keep `^(done|blocked)` as one expression.
   const terminal = String(phase).match(/^(done|blocked)\b/i)?.[1]?.toLowerCase() || '';
@@ -1426,6 +1505,27 @@ export async function evaluateHandoffCursor({ projectRoot, runRoot = projectRoot
   // task index — the default `all(index:all-done)` applies so a run-all goal
   // cannot claim done over an unfinished backlog. No INDEX.md at all → the
   // legacy phase-only release (nothing in scope to prove).
+  // Session scope: a run owned by another session must not hijack an unrelated session. Decided
+  // before pause and before every `done` branch, so a non-owner session never receives the pause
+  // advisory. Only a positive "not fullstack" releases; unknown (null) keeps the block.
+  const transcriptOwner = gate.scope === 'session' ? await transcriptShowsHandoffRun(transcriptPath) : true;
+  if (gate.scope === 'session' && transcriptOwner === false) {
+    return { kind: 'none' };
+  }
+
+  // PAUSED run: never force continuation. Pause outranks every `done` branch below — the
+  // default-predicate early returns (empty/header-only INDEX → `none`) included — so a user-paused
+  // run is never reported as completed. Advisory, never `none`: no completion is minted here.
+  const pausedIntent = await loadHandoffIntentModule();
+  if (pausedIntent?.runCursorPaused?.(text) === true) {
+    return {
+      kind: 'advisory',
+      waitForApproval: true,
+      systemMessage: '[ukit-stop-coordinator] handoff run is PAUSED: stop allowed, nothing is resumed or forced. '
+        + 'Only an explicit user instruction (/ukit:handoff-fullstack or "continue") lifts the pause.',
+    };
+  }
+
   let effectivePredicate = exitPredicate;
   let predicateIsDefault = false;
   let openNextCycle = null;
@@ -1438,7 +1538,7 @@ export async function evaluateHandoffCursor({ projectRoot, runRoot = projectRoot
       // Header-only INDEX = this CYCLE is finalized, not necessarily the GOAL: a run-all goal
       // continues while consumable queued blueprints remain (or the backlog is unreadable).
       if (goalScope !== 'run-all') return { kind: 'none' };
-      const remaining = await pendingQueuedBlueprints(runRoot);
+      const remaining = await pendingQueuedBlueprints(runRoot, parseScopeQueue(scopeQueue));
       if (Array.isArray(remaining) && remaining.length === 0) return { kind: 'none' };
       openNextCycle = { remaining };
     } else {
@@ -1452,11 +1552,6 @@ export async function evaluateHandoffCursor({ projectRoot, runRoot = projectRoot
   // must not be bounced into a stale run. Only a positive "scanned the whole
   // transcript, latest intent is not fullstack" releases; unknown (null) keeps
   // the block, so a real run is never released by a lost read.
-  const transcriptOwner = gate.scope === 'session' ? await transcriptShowsHandoffRun(transcriptPath) : true;
-  if (gate.scope === 'session' && transcriptOwner === false) {
-    return { kind: 'none' };
-  }
-
   if (terminal === 'done' && openNextCycle) {
     const names = openNextCycle.remaining;
     return {
@@ -1477,7 +1572,7 @@ export async function evaluateHandoffCursor({ projectRoot, runRoot = projectRoot
   if (terminal === 'done') {
     let predicate;
     try {
-      predicate = await evaluateExitPredicate(runRoot, effectivePredicate, { goalScope });
+      predicate = await evaluateExitPredicate(runRoot, effectivePredicate, { goalScope, scopeQueue, cycleField });
     } catch {
       return { kind: 'none' }; // advisory lane: evaluator failure never wedges a stop
     }
@@ -1528,17 +1623,6 @@ export async function evaluateHandoffCursor({ projectRoot, runRoot = projectRoot
     return { kind: 'none' };
   }
 
-  // PAUSED run: never force continuation.
-  const intentMod = await loadHandoffIntentModule();
-  if (intentMod?.runCursorPaused?.(text) === true) {
-    return {
-      kind: 'advisory',
-      waitForApproval: true,
-      systemMessage: '[ukit-stop-coordinator] handoff run is PAUSED: stop allowed, nothing is resumed or forced. '
-        + 'Only an explicit user instruction (/ukit:handoff-fullstack or "continue") lifts the pause.',
-    };
-  }
-
   // No-progress breaker inputs: the stall signature now carries the INDEX
   // ids+statuses hash, so an unchanged task snapshot accrues toward the cap even
   // when the cursor wording keeps moving — and reconciling a new task or moving
@@ -1573,7 +1657,7 @@ export async function evaluateHandoffCursor({ projectRoot, runRoot = projectRoot
     let predicateState = 'no ExitPredicate recorded';
     if (effectivePredicate) {
       try {
-        predicateState = formatPredicateState(await evaluateExitPredicate(runRoot, effectivePredicate, { goalScope }));
+        predicateState = formatPredicateState(await evaluateExitPredicate(runRoot, effectivePredicate, { goalScope, scopeQueue, cycleField }));
       } catch {
         predicateState = 'predicate evaluation failed';
       }

package/template_project/.claude/ukit/runtime/task-watchdog.mjs

@@ -206,7 +206,7 @@ export async function mutateWatchdogState(statePath, updater, { signal, deadline
 }
 
 // ─── Task parser ──────────────────────────────────────────────────────────
-const TASK_ID_REGEX = /^#\s+TASK-([0-9]+[A-Za-z0-9._-]*)\b/m;
+const TASK_ID_REGEX = /^#\s+TASK-((?:C\d+-)?[0-9]+[A-Za-z0-9._-]*)\b/m;
 const STATUS_REGEX = /^-\s*Status:\s*`?([a-z_]+)`?/m;
 const SIZE_REGEX = /^-\s*Size:\s*`?([SML])`?/m;
 

package/template_project/.omp/agents/code-reviewer.md

@@ -211,8 +211,9 @@ additions:
 
 ### Inputs you expect
 
-- Path to the spec/plan document (e.g. `docs/plans/*.md`). No diff, no task file, no executor report — review the document itself.
+- Path to the spec/plan document (e.g. `docs/plans/*.md`). No diff and no executor report.
 - When invoked from the handoff pipeline you get BOTH `docs/AI_HANDOFF/SPEC.md` and `docs/AI_HANDOFF/PLAN.md`. Review them as one unit: the spec is the contract, the plan is the decomposition. Verdicts still append to PLAN.md's `## Plan Review Log`.
+- A plan is not reviewable from SPEC+PLAN alone. Start from the original: `SOURCE.md` (verbatim original bytes; verify the recorded sha256 against them, and for chat input the durable verbatim message origin stands in for the file), then the classification in `LEDGER.md` (every row dispositioned, feasible/adapted rows carry evidence), `NOTES.md` when present (optional source-only notes; a missing note is caught because the chain starts at SOURCE, not at NOTES), the `tasks/TASK-*.md` files of that plan (spec references, acceptance and verification), and the current source the Target Files touch (index-first). Compare the chain SOURCE → classification (LEDGER) → tasks; check NOTES against the same chain. A `feasible`/`adapted` requirement that the ledger or source shows but no task covers is a Completeness finding, unless it is exempt when their queue entry, owner decision, or classification is recorded (deferred, blocker, rejected, proposal, and example rows are not tasks); a task whose verification does not prove its acceptance is a Clarity finding.
 
 ### Review order
 
@@ -240,6 +241,8 @@ Only flag issues that would cause real problems during implementation planning.
 
 Append (do NOT overwrite) this block to the end of the reviewed document under a `## Plan Review Log` section — create the section if it doesn't exist yet, keep all prior round entries:
 
+Every finding bullet is written as `<location> :: <claim>` (location = the SOURCE/LEDGER/NOTES/TASK/SPEC/PLAN line or section it cites; claim = the defect in one sentence). The planner derives the finding signature from this exact pair (lowercased, whitespace collapsed, claim truncated to 120 characters), so keep it stable across rounds for an unchanged defect.
+
 ```
 ### Round <N> — <YYYY-MM-DD> · <your model>
 Status: Approved | Issues Found

package/template_project/.omp/agents/handoff-planner.md

@@ -286,5 +286,8 @@ budget is the constraint on the whole run. Detail belongs in `PLAN.md`, not in t
 
 - Do NOT implement. Job ends when all tasks are `ready` or `needs_breakdown`.
 - Undone tasks in INDEX.md → continue that cycle; plan only what is still missing. Do not ask whether to start fresh, and do not overwrite task files that already carry an executor report or reviewer verdict.
+- An independent new request is never an overwrite of a ready plan. Overwrite only when the human explicitly names the existing plan to amend. First copy every prior file (PLAN.md, SPEC.md, LEDGER.md, NOTES.md, SOURCE.md, tasks/TASK-*.md, when present) to the next unused `amendments/rev-<NN>/` (scan existing rev dirs, take max+1, never reuse one). Then compose the revised PLAN.md in full: carry the existing `## Amendment History` forward and append this amendment's entry (prior review rounds and verdicts; prior requirement, decision and task versions with what changed and why; each change's `invalidated` evidence: tasks, executor reports, verdicts that no longer hold). Write the revised PLAN.md only after that entry is in the composed text. Otherwise write to the queued root.
+- A task that already carries an executor report is superseded, never overwritten: write the replacement as `TASK-<id>-R<n>.md` and keep the original file with its report.
+- Round cap: count only completed reviewer verdicts (`### Round` entries with a `PLAN_REVIEW:` or verdict line). Repair markers (`### Repair <N>`, `### Escalation <N>`) are never counted. When two verdicts exist and no escalation is recorded, record `### Escalation 1 — <reason>`, apply the findings with a changed strategy (`### Repair <N> — changed strategy`), and let the reviewer run once more. If the escalation is already spent, do not request another round: mark still-flagged tasks `needs_breakdown` and write `PLAN_REVIEW: Unresolved — …`, never `Approved`. Identical findings after a repair (the finding signature set is unchanged) are non-progress: do not run another identical loop; retain Unresolved with a precise diagnostic. **Recovery exception (explicit, at most once per plan):** it runs only when the escalation is spent, the latest verdict is still `Issues Found`, the latest repair changed the signature set, and the Plan Review Log has no `### Recovery 1 — consumed` marker. Then, in order: (1) append `### Recovery 1 — consumed <YYYY-MM-DD>` before any other work; (2) run a root-cause investigation and a different decomposition; (3) request one fresh independent review of the changed artifact and append its verdict as `### Round <N>`. The marker is never removed or re-created. If the marker already exists, or the signature set is unchanged, do not request another review: retain Unresolved with a precise diagnostic. An owner conflict routes an owner decision. Never mark a plan `Approved` by the cap alone. After every verdict, append `### Signatures Round <N>: <sig>; <sig>; …` where each `<sig>` is the reviewer's `<location> :: <claim>` pair normalized (lowercased, whitespace collapsed, claim first 120 characters). Mandatory overflow (feasible/adapted rows beyond the 10-task dispatch window) is grouped by dependency chain into `queued/<plan-slug>-overflow-<NN>/` (max+1 index; on collision append `-2`, `-3`, …), never a deliberate-future header.
 - Cannot determine test cases → `needs_breakdown` + Discussion thread note. Never mark a task `ready` with vague tests just to keep the pipeline moving — a task with fake tests passes review and ships a bug, which costs far more than one blocked task.
 - You may be invoked unattended. Ask nothing; where the caller allowed questions, that window closed before you were spawned. Resolve ambiguity by reading the codebase, choose the option you would recommend, and record the choice and its rationale in `PLAN.md §3`.

package/template_project/AGENTS.md

@@ -110,7 +110,7 @@ Chỉ active khi task đi qua `docs/AI_HANDOFF/` ("execute task TASK-xxx" hoặc
 <!-- RULE: UNATTENDED-02 -->
 - `maxAttemptsPerFailure: 2`, `maxRecoveryStrategies: 2` distinct fix strategies before reassessing — retry the same edit, then fix the cause differently; never loop one strategy.
 <!-- RULE: UNATTENDED-03 -->
-- BLOCKED only on true external blockers: missing credentials, dead service, unreachable network/API. Test failures, lint errors, review findings, ambiguity are NOT blockers — feed FIX.
+- BLOCKED only on true external blockers: missing credentials/permissions, dead service, unreachable network/API, or a genuine requirement conflict that needs an owner decision. Test failures, lint errors, review findings, plan findings, ambiguity within scope are NOT blockers — feed FIX (bounded strategies, then investigate/replan) and continue independent scope tasks.
 <!-- RULE: UNATTENDED-04 -->
 - A deny (hook/gate/permission) never becomes a question: pick the next safer alternative satisfying the intent, record the substitution. Never emit "do you want me to…" — decide and proceed.
 
@@ -152,7 +152,7 @@ DuraOne skill chỉ active khi pack `duraone` được cài hoặc `.claude/skil
 
 ## Handoff Fullstack Rules
 <!-- RULE: HAND-02 -->
-- `docs/AI_HANDOFF/RUN.md` là run cursor có thẩm quyền; `Phase:` ≠ `done`/`blocked` = run còn sống — Stop gate từ chối stop, trả về `Next:`. Chỉ `HANDOFF FULLSTACK COMPLETE`/`BLOCKED` kết thúc run — recap/checkpoint không phải completion; resume tự động mọi task chưa xong. Kết thúc cycle: docs sync → archive `archive/cycle-NN/` → `Phase: done`; `handoff-clear` bắt buộc đóng RUN.md. Full rules: `docs/AI_HANDOFF/RULES.md`.
+- `docs/AI_HANDOFF/RUN.md` là run cursor có thẩm quyền; `Phase:` ≠ `done`/`blocked` = run còn sống — Stop gate từ chối stop, trả về `Next:`. Chỉ `HANDOFF FULLSTACK COMPLETE`/`BLOCKED` kết thúc run — recap/checkpoint không phải completion; resume chỉ tiếp tục frozen scope khi `Paused: no` và session thuộc ownership (resume marker hoặc `/ukit:handoff-fullstack` tường minh), không tự inject ở startup/clear mới. Kết thúc cycle: docs sync → archive completed-only `ARCHIVE/cycle-NN/` → `Phase: done`; `handoff-clear` khi còn việc mở đặt `Paused: yes` (giữ phase/scope/recovery, không mint completion, không xóa cursor). Full rules: `docs/AI_HANDOFF/RULES.md`.
 
 ## Compact Instructions
 Compact giữa handoff run: giữ goal, RUN.md path + phase, task inventory + task đang làm, `Next:` step, blockers, verification evidence, commits, worktree/copy-back state, "compact không phải completion". Sau compact: đọc lại RUN.md + INDEX.md rồi chạy `Next:`.

package/template_project/CLAUDE.md

@@ -110,7 +110,7 @@ Chỉ active khi task đi qua `docs/AI_HANDOFF/` ("execute task TASK-xxx" hoặc
 <!-- RULE: UNATTENDED-02 -->
 - `maxAttemptsPerFailure: 2`, `maxRecoveryStrategies: 2` distinct fix strategies before reassessing — retry the same edit, then fix the cause differently; never loop one strategy.
 <!-- RULE: UNATTENDED-03 -->
-- BLOCKED only on true external blockers: missing credentials, dead service, unreachable network/API. Test failures, lint errors, review findings, ambiguity are NOT blockers — feed FIX.
+- BLOCKED only on true external blockers: missing credentials/permissions, dead service, unreachable network/API, or a genuine requirement conflict that needs an owner decision. Test failures, lint errors, review findings, plan findings, ambiguity within scope are NOT blockers — feed FIX (bounded strategies, then investigate/replan) and continue independent scope tasks.
 <!-- RULE: UNATTENDED-04 -->
 - A deny (hook/gate/permission) never becomes a question: pick the next safer alternative satisfying the intent, record the substitution. Never emit "do you want me to…" — decide and proceed.
 
@@ -144,7 +144,7 @@ DuraOne skill chỉ active khi pack `duraone` được cài hoặc `.claude/skil
 
 ## Handoff Fullstack Rules
 <!-- RULE: HAND-02 -->
-- `docs/AI_HANDOFF/RUN.md` là run cursor có thẩm quyền; `Phase:` ≠ `done`/`blocked` = run còn sống — Stop gate từ chối stop, trả về `Next:`. Chỉ `HANDOFF FULLSTACK COMPLETE`/`BLOCKED` kết thúc run — recap/checkpoint không phải completion; resume tự động mọi task chưa xong. Kết thúc cycle: docs sync → archive `archive/cycle-NN/` → `Phase: done`; `handoff-clear` bắt buộc đóng RUN.md. Full rules: `docs/AI_HANDOFF/RULES.md`.
+- `docs/AI_HANDOFF/RUN.md` là run cursor có thẩm quyền; `Phase:` ≠ `done`/`blocked` = run còn sống — Stop gate từ chối stop, trả về `Next:`. Chỉ `HANDOFF FULLSTACK COMPLETE`/`BLOCKED` kết thúc run — recap/checkpoint không phải completion; resume chỉ tiếp tục frozen scope khi `Paused: no` và session thuộc ownership (resume marker hoặc `/ukit:handoff-fullstack` tường minh), không tự inject ở startup/clear mới. Kết thúc cycle: docs sync → archive completed-only `ARCHIVE/cycle-NN/` → `Phase: done`; `handoff-clear` khi còn việc mở đặt `Paused: yes` (giữ phase/scope/recovery, không mint completion, không xóa cursor). Full rules: `docs/AI_HANDOFF/RULES.md`.
 
 ## Compact Instructions
 Compact giữa handoff run: giữ goal, RUN.md path + phase, task inventory + task đang làm, `Next:` step, blockers, verification evidence, commits, worktree/copy-back state, "compact không phải completion". Sau compact: đọc lại RUN.md + INDEX.md rồi chạy `Next:`.